Network Security's Role - Assignment Example

Table of Contents Section Page No. 1. Introduction 3 2. DGH Current Network Configuration 3 2.1. Operating Systems 3 2.2. Web and Network Application 3 2.3. Existing Network Structure 4 2.4. Building Exit and Access Points 4 2.5. Current Security Configuration and Personnel 4 2.6. Remote Workstation Configuration 5 2.7. Password and User Authentication Application 5 2.8. Anti Virus and Firewall 5 2.9. Company Website 5 2.10.Email Server 6 2.11. Disaster Recovery Plan 6 2.12. Backup and Restore 6 3. Key Security Concerns and Issues 6 3.1. Authentication and Control for Remote Access 6 3.2. Password Inflation 7 3.3. Anti-Virus and File Protection 7 3.4. Firewall and Intrusion Detection 7 3.5. Wireless Access 7 3.6. Client Access (On and Off Site) 7 3.7. Remote Authentication 7 3.8. Security on Website 7 3.9. Disaster Recovery Plan and Backups 8 4. Recommendation 8 5. Appendix 13 5.1. Mobile Based Biometric Authentication 13 5.2. Solution to Password Inflation 19 6. References 24 1. Introduction Network security is not normally the centre of proficiency for most enterprises and they probably do not have the time or satisfactory resources to provide the essential requirements. The absence of effective security policy compromises the availability of a network. A weak security designs often are not optimal and results in network vulnerabilities thus a comprehensive security design is critical to the safety of the network. The process starts with the assessment of risks and evaluating the current network configuration and security policy. As a result, a comprehensive report on key security concerns including analysis and recommendations to help change and improve security management and monitoring. 2. DGH Current Network Configuration DGH, a large multinational company, has 236 members of staff currently connected to the company’s network. 2.1. Operating Systems a. Windows 98 with Service Pack 2 (older machines) b. Windows XP with Service Pack 1(newer machines) 2.2. Web and Network Application a. Email b. Web Browser c. Intranet Database Application 2.3. Existing Network Structure Layout Details: a. Building has 11 floors b. 1st Floor reserved for meeting, canteen, and amenities c. Two to Tenth floor –average 26 staff each d. 11th floor –directors, dept. heads, and secretaries e. Hubs and Switches Rack- located at broom cupboard on each floor 2.4. Building Exit and Access Points Details: a. Reception Area for Visitors – 2nd floor (Employees are not restricted in or out) b. Receptionist available only from 8:00AM to 5:30PM c. Security manning the reception area from 5:30PM onwards d. Single CCTV camera facing entrance door directly transmitting live feed to reception desk. e. Three (3)– Emergency Exits (frequently used for Smoking and occasional deliveries) 2.5. Current Security Configuration and Personnel a. Fast Ethernet Network without security baseline in placed. b. Service Pack based security c. Visitor’s AV free laptops are allowing access to network. d. No policy for remote access. e. Four (4) -Highly trained support specialist answering day-to-day queries. f. Two (2) - Qualified Network Administrators (assisted by support specialist whenever available) g. One (1)- Chief Information Officer running the IT Department 2.6. Remote Workstations Configuration a. Thirty two (32) laptops accessing away from main site. b. Protected by standard Windows based user authentication. c. Serial number not recorded. d. Simple procedure in recording make, model, and equipment details. e. No BIOS and Hard Drive password administered. f. No Wireless Access 2.7. Password and User Authentication Application a. Corporate Product Database b. Intranet Access c. Windows Log-on d. Corporate Statistical Package 2.8. Antivirus and Firewall a. Server based AV (updates downloaded regularly) b. No AV for Workstation c. NAT based Firewall (for Intrusion and DOS based attacks) d. No IDS (Intrusion Detection System) e. No policy on remote access for databases. (Currently using web front) 2.9. Company Website a. Customer can access product from the website. b. No credit card or any financial transaction. (Product orders only) c. Website designed from MS Publisher. d. Allow all type of access (HTTP, NETBIOS, etc.) 2.10. Email Server a. Simple Mail Server b. No advanced user authentication c. Microsoft Outlook client for off-site access d. No encryption employed for email transmission e. No SPAM control 2.11. Disaster Recovery Plan a. No recovery plan currently in effect b. Insurance covered by Mutual Insurance PLC 2.12. Backup and Restore a. Backup through Central Storage System b. Option to save data to hard disk drives, recordable CD, Flash drives 3. Key Security Concerns and Issues 3.1. Authentication and Control for Remote Access a. Insufficient authentication for off-site access through laptop computers b. Procedural flaws in recording serial numbers, make, model, and equipment details c. BIOS information not properly protected by password for each machine 3.2. Password Inflation a. Excessive authentication requirements using different user names and passwords b. No automatic authentication procedures such as auto-email sending for log-in details 3.3. Anti-Virus and other File Protection a. Anti-virus is only limited to server b. Workstation do not have direct virus protection 3.4. Firewall and Intrusion Detection a. Insufficient Firewall configuration b. No Intrusion Detection System 3.5. Wireless Access a. No wireless access 3.6. Client Access (Off and On-Site) a. No internal anti-virus in access points b. No clear procedure in placed for total virus protection from client’s machines. 3.7. Remote Authentication a. There is no clear security policy for staff’s remote access from their homes. b. Corporate database access directly coming from the web using same username and password issued for Intranet use. c. No dial-up or VPN access 3.8. Security on Website The current website simple design is vulnerable to a number of attacks such as SQL Injection, Cross Site Scripting etc. It allows all types of access that is not ideal for a network with little or no effective security policy in place. a. There is no strong authentication procedure implemented. b. There is no encryption infrastructure to protect email transmission. c. Email server does not have SPAM filtering capability. 3.9. Disaster Recovery Plan and Data Backup a. Although the company’s infrastructure is insured, they do not have a disaster recovery plan to counter any unexpected adversity. b. Insufficient frequency of backups schedules. 4. Recommendation The above security concerns and issues clearly indicate insufficient security policy thus development of an effective security strategy to protect all parts of the current network is required. To achieve our goal we must follow structured set of step in developing and implementing proper network security. First, we must fully identify the network assets and analysed the security risk involved. This includes analysing security requirements and tradeoffs, develop a strong security plan, and define the security policy (Oppenheimer, 2004). Trust is a the main principle in the development of security policy and therefore the organization must determine who will gets access and who are not? The organization must decide when and where a certain staff can be given access to resources available in organization’s network. Furthermore, we must also consider the limitation of providing such privileges into a large group of personnel that may lead to further security problems. On the other hand, granting access or giving too little trust may result in employee’s loss of interest and confidence (Oppenheimer, 2004) Trust is always in the centre in many policies and some policies may not be needed for people we know or trust to do the right thing. Policies are needed for those people that will not always do the right thing. Normally, we want to trust all resources. However, this is unrealistic and we might as well prepare to minimize the impact when an actual failure occurs because bugs in hardware and software are ordinary. It is also necessary to categorized employees to different levels of trust and ensures the level of access proportionate to that level of trust. One of the possible trust model is to “trust everyone all of the time”. It is easier to implement but impractical because one bad apple can destroy the whole barrel. Another model but certainly not applicable is “not to trust anyone at no time”. The recommended and probably the most common model in many organization is to “trust some people some of the time” where organization will exercise caution for trust given to a certain person and granting access only when needed (Guel, 2001). Security policies tend to increase the intensity of tension in some situation. People normally don’t like rules or restrictions and they view security needs differently. Being able to get their job done without too much control bothers some people. The system support is also concern about the ease of managing the systems under tight control and management is more interested in cost that security. It is therefore necessary to listen to all sides and try to reach a win-win solution. In general, although there are a lot argument and justifications for their persona reason, everyone should be concerned in security policies because all of them maybe affected to some extent. The organization should now decide and select a policy development team. Designate a person or group that would serve as the official policy interpreter. Determine the goals and scope of the policy, who are covered? How specific is the policy? As much as possible, notify those affected by the new policy and explain why this policy is required. Allow them to express their concern and review the policy to become aware of the whole the process and take their responsibility seriously. As a basic rules, policies must be easy to implement and enforceable, concise and easy to understand, and there should be a balance between protection and productivity. The goal of policy is to implement control thus culture and security needs plays a major role in determining which level of control is applicable. Too tight policies are harder to implement, they will be ignored or staff will find a way to evade the rules in the policies. The Acceptable Use Policy is one of the most important policies that an organization should have. Without it, users and staff have no reference when trying to impose penalties for violation of safe computing practices (Guel, 2001). a. The policy should state the user’s responsibility in protecting the data or information stored on their accounts. b. Specify whether they can read or copy files that don’t belong to them. c. Discuss the level of acceptable usage or limitations for email, Internet news, and web access. d. Clarify the acceptable level for non-business or personal use of the resources. For remote access policy: a. Define the acceptable methods of accessing internal network remotely. b. Cover all available devices to access internal resources from remote sites or at home such as dial-up, ISDN, TELNET, DSL, etc. c. Clearly define who should have remote access and what specific method is required for such access. d. Specify which method and speed are allowed for such remote access e. Limitations on the data that can be accessed remotely. f. Provide baseline requirement for the use of Anti Virus software and provide guidelines for reporting and preventing virus infections. g. Discuss the essentials for scanning email attachments and other sort of incoming files. h. The organization should consider buying new mobile hardware with Biometric Technology such as Toshiba, ThinkPad, and Fujitsu. These mobile computers are equipped with fingerprint readers that can enhance user authentication. Furthermore, they also support password authentication combined with biometric enhancement. i. They company should also purchase enterprise anti-virus products like Norton AV and McAfee. The enterprise edition of these products includes workstation protection and personal firewalls. For passwords: a. Guidelines on how user level and system level passwords are managed and changed. b. Explain the password creation rules. c. Discuss the danger and how password can be protected from disclosure. d. Encourage users to use SNMP strings and pass-phrases Security Procedures: a. Define what is to be protected and how to protect them. b. Discuss in detail actions to be taken in case of specific incidents c. Provide quick reference on what to do in time of crisis. d. Clearly, discuss the procedures they should follow in a particular situation. Configuration Management Procedure: a. Specify how new hardware or software is to be installed or tested. b. Discuss the importance in documenting hardware and software changes. Data Backup and Remote Storage Procedures: a. Clarify which file systems are included in the backup. b. Define the frequency the on-site and off-site backups. c. Discuss the importance of labelling backup media. Incident Handling and Disaster Recovery a. Set a clear guideline on how to handle anomaly investigation and intrusion attacks. b. Define respective responsibilities of members and the response team. c. Clarify what information is to be recorded and tracked. d. Identify the person who will be notified and when. e. Identify the person who can release the information and discuss the procedure in releasing that information. f. Discuss the follow-up analysis procedure and the persons who will form the group. 5. Appendix 5.1. Mobile based Biometric Authentication Off-site access particularly with mobile computers such as laptops means storing full or partial data away from the main site. These computers are normally equipped with access codes or authentication information of the corporate server. In addition, if the user decided to save some confidential data in his mobile computer, these data without the required protection are readily available to anyone with the opportunity to get his hands on the laptop. Enabling BIOS or hard drive passwords is not overkill. It is the primary or the first line of defence when the computer unit which by any means stolen. Furthermore, it is a good practice to restrict access to any computer unit to prevent unauthorized manipulation of data and to ensure that the computer is protected in any situation. The windows user authentication system is not enough to ensure authorized access. A commercial operating systems standard user authentication considered having weak encryption and considerable vulnerabilities. Biometric hardware seems to provide adequate solution to a wide range of authentication problems. Biometric authentication, which started from desktop application, is now available to support network authentication systems. Biometric with various options available can provide voiceprint, facial scan, retinal patterns, and fingerprints authentication. If the company really wants to pursue Biometric authentication, we must always think about the benefits and limitations of the piece of equipment we choose. Fingerprint Scanners is a low cost biometric device compatible to a mobile and desktop computer environment. It works by taking a mathematical snapshot of the loop and swirls of the user’s fingerprint and converts these characteristics into a string data that can be encrypted and save in a database. These strings represent a unique identifier for a particular user that only he possesses. Depending on the vendor, there various technologies that can handle this process however the functionality and ease of use comes first. With the growth of wireless communication technologies and mobile computing, trust has become a central issue for e-Commerce. As the mobility increases, mobile computers are and more vulnerable to theft. In 1999, TCPA or Trusted Computing Alliance encourages the industry to develop and adopt open specification for the enhancement of computing platform. The focus of the group is to ensure privacy and enhance security. TPM is defined as a hardware instantiation of the TCPA specification. Mobile computers security threats are classified into physical theft, data communication attacks, and Threat Matrix (Bajikar, 2002). The TPM architecture with the support of software and firmware offers the platform root of trust. It is a secure micro-controller with cryptographic functionalities connected to the PC chipset through a Low Pin Count (LPC). Its crypto capabilities provide crypto functions to TPM hardware while software agents outside the TPM can only perform IO operations. The TPM also perform 2048-bit RSA encryption and decryption. It has a built in hash engine to compute hash values for smaller pieces of data. The larger ones are hash outside TPM to prevent disintegration of hardware performance. The TPM uses Random Number Generator to process keys for various purposes (Bajikar, 2002). Toshiba’s EasyGuard™ technology is a series of hardware and software improvements intended for notebooks that greatly enhance mobile computing. Providing portable computer users with improved data security, system safeguards, straightforward connectivity and simplicity of use, thus providing users with a better, more reliable notebook experience (Toshiba, 2006). The TPM is embedded in Toshiba’s main board. The TPM security chip saved login details and passwords on the main board instead of the usual memory module. Using this method, data cannot be retrieved or view by any person except an authorized user. It encrypts sensitive data and conceals the key to the vault storing the information. TPM is integrated into the operating system thus included in computer’s booting process. Importantly, TPM can endure virtual and physical attacks to shield crucial information (Toshiba, 2006). Another portable computer brand with TPM is Lenovo’s ThinkPad Notebooks. On certain models of ThinkPad notebooks, an integrated fingerprint reader is available at the palm rest. It has a slide sensor to extract the characteristics of the user’s fingerprint as it pass over the sensor. To provide protection against fingerprints lifted or just taken from a surface, Lenovo ThinkPad notebooks employ Capacitive Sensing to detect electrical properties from a living layer of the skin. The properties of the skin’s superficial dead layer are different from an actually living layer from a living person. The fingerprint reader can serve as an authentication device to replace BIOS and the standard Windows login. It will also work for ThinkVantage Client Security Solutions by providing authentication services. The ThinkPad with Client Security Solutions employs two-factor authentication. Aside from authentication provided by the fingerprint reader, it can also require password as an added security. The Fujitsu’s Palm SecureTM is another portable computer with biometric technology. The palm vein authentication device provides authentication accuracy and application versatility. This makes forgery difficult considering character identifier internal to the body. Palm SecureTM features faster authentication speed, a smaller sensor measuring 35mmx35mm, expanded operating temperature range at a low price (Fujitsu Press Release). The palm vein technology reads the unique vein pattern in your hand by simply holding your palm a few centimetres away from the scanner. The vein image is taken and your unique pattern is then registered to a database. This will serve as your profile and no one else can login under this profile. The palm vein technology also supports ATM transactions. The false rejection rate of this technology is 0.01% and a false acceptance rate of less than 0.00008%. The biometric user information is stored at bankcards thus enabling secured ATM transaction (Fujitsu Press Release). A few of the many software support for this biometric hardware in laptop and desktop computers are the following: BioLogon 2.0 Server for Windows from Indeticator Technology offers eight combinations of fingerprint, password and smart card authentication. With BioLogon 2.0, users can register using multiple fingers. Although it has a default allowing four fingers, it can also accommodate up to eight fingers per user. BioLogon can automatically generate random passwords and with Windows NT password expiration setting, it has triggers to count the number of log-ins or days of password expiration. BioLogon user registration is easily by using checkboxes for convenient point and click access setting. In addition, user policy editing is available through pull-down menu at main user manager console with individual user setting for a more flexible policy control. BioLogon comes with a Fingerprint Enrolment Wizard that is capable of guiding new user to the registration process. IT staff could choose to tune and configure the fingerprint scanner to ensure maximum fingerprint read and possible to select how many fingers they want to scan. It allow one-touch authentication to login however, non-biometrics users must still use the standard authentication by entering their user names. BioLogon Security Control panel is located on the client or server with setting that offers Security Thresholds, Audit Levels and Components. The Audit Levels in the security panel provides normal event tracking, full diagnostics and detailed event logging. The diagnostic tab provides real-time description of biometric authentication activities. In the components tab you will find a diagnostic button to confirm that all settings and installed components are correct, secure, and working properly including verification of version numbers and details. Other useful feature of BioLogon is the ability to scan regardless of finger rotation angle, which is a benefit to user convenience. The system also made it easy to access different modules by providing clickable links on the systems tray and every configuration screen provides “What’s this” links resembling Windows configuration panels that would give user an idea of each option he wants to select. During installation, BioLogon automatically detect the fingerprint reader and will configure accordingly. BioLogon is the most capable of integrating closely with Windows NT. SAF2000 Multi-Biometric Enterprise Security Suite from Saflink Corporation offers to modes of set-up and supports authentication in various environments such as Microsoft IIS and Novell Netware. The first mode is a systematic model using a wizard to determine the security needs of the network including OS and current installation option. The next one is the custom installation mode for experienced administrators, which is a straightforward selection of components and platforms to be included in the installation. On the other hand, SAF2000 requires that Microsoft SQL server 6.5 preinstalled on the server. The SAFserver is separately installed from the primary domain controller to handle all authentication requests. Workstations are set-up to point to the SAF authentication server by name where authentication comparison is done. The SAF2000 suite supports fingerprint, face, and voice biometrics. It uses the administrator-controlled trust model and an administrative control panel handles configuration. The server manager offers standard functionality such as adding computers and enables biometrics on client workstations. The control panel enable administrator to set password generation options and configure the auditing functions. Like BioLogon, it can also integrate with Windows NT user manager. User registration although a little different from BioLogon, SAF2000 requires four different images to be taken. Unlike BioLogon, it does not allow configuring password expiration and replacement criteria. It is automatically replacing passwords with an unknown random during user registration. SAF2000 is by default disabled. When selected, it has an informative event logging tracks and monitors biometric activities. Administrators can easily see time-stamped entries including failed attempts. The SAF2000 license manager makes it convenient to manage license with at a glance details of total licenses, percentage of use, and specific certificate in use. 5.2. Solution to Password Inflation Password inflation became a major challenge due to the large and rapidly growing applications and services, and the massive and increasing user base. According to Gartner Research, password inflation is a situation when a user has to memorize a number of passwords to access the tools they want on the network. It makes systems hard to use resulting in user irritation and decreased productivity. In addition and maybe worse, password inflation increases administration cost and security risk (Novell, 2003). According to a report, almost 30% of held desk calls are password related. The estimated to cost is around $24 to $50 every time an end user calls for help. Password inflation also increases administration cost because IT personnel have to manage multiple passwords for various systems. The work is consuming considerable amount of administrator’s time that could then be use for strategic issues (Novell, 2003). Password inflation contributes to security risk increase in various ways. When users constantly forgetting their different passwords they have the tendency to write it down, use weak password or reusing old familiar ones. This kind of situation encourages password theft and endangers valuable corporate resources (Novell, 2003). Secure identity management is the ability to grant users in and out of the company secure access to the organizations network infrastructure by according to their business relationships and role (Novell, 2003). Novell-Nsure password management solution as the key components of Novell’s secure identity management solution offers to simplify the use and management of passwords. It can help organizations augment their user experience, enhance security, simplify business processes and lessen system administration and support cost. To counter these challenges presented by standard password management and practices, a new password management solution must meet the four major requirements. a. It must simplify access for users b. Must have strong security c. Must have support for external user access d. Comprehensive technology and services Novell-Nsure has a number of advanced and integrated technologies such as c. Enterprise Single sign-on – the user need only to remember a single password and login once to access all tools in the network. d. Web Single Sign-on – authorized users can access all the web-based resources from the Internet using a single password. e. Password synchronization – users are allowed to use same passwords for all applications. f. Self-service password reset – users do not need to call the help desk to reset their password. They can do the reset on their own. g. Federated Authentication – users can access services and resources on partner websites using a single set of credentials. h. Advanced Authentication- organizations can now attach robust authentication methods like tokens, smart cards, and biometric devices. Novell-Nsure password management solutions enhance security with several important capabilities by barring the use of weak passwords such as those based on user names or common words. The solution can implement a range of password policies, together with requiring that passwords must include such components like special or case sensitive characters and require minimum number of characters in the password (Novel, 2003). It can also prevent reuse of passwords and enforce periodic changes to particular password. It has support for one-time password use. These passwords can only be use once and on certain period. It can also eliminate lingering access for employees who no longer work for the company by immediately revoking his privileges. The administrator can immediately shut-off access privileges including password across all systems in a single update. The solution can also lock-down idle workstations to prevent unauthorized access and it can limit help desk and administration privileges allowing technicians to reset passwords without granting unnecessary administrative privileges (Novell, 2003). Another solution to prevent password inflation and much simpler than the Novell-Nsure suite is the SSO or Single Sign-On Technology. SSO or Single Sign-On Technology comes in quite a few architectural variation, most of which depend on a central server to facilitate authentication, permission, password management, and monitoring. In other words, the various architectures can be grouped into two types: password synchronization and true SSO. Password management technology obliged users to sign onto every system independently, but it synchronizes their password across the network. In other words, users have multiple ID, one for each system but using a single password. With true SSO, a particular encrypted "key" allows users to enter all authorized intended systems using just one password and an ID. With this method, main SSO servers authenticate users by querying information available in a security database. This database stores user identification and system or application information. When the user pass the authentication, he will be given a session ID that permit transparent validation while crossing different systems and servers (Bigler, 2004). Enhance authentication in its most basic form, SSO is considered a single-factor authentication system, as it need one input, a password. Combining SSO with other technology can further enhance security. One-time passwords (OTPs) and biometrics combined with SSO to produce either a two-factor or a multi-factor authentication system (Bigler, 2004). Biometrics technology is an automated technique of identifying individuals on a unique set of physiological traits. The identity can be establish by determining face, fingerprint, hand geometry, handwriting, iris, retinal, vein, or voice characteristics. Biometric and SSO technology combination can create two-factor authentication by incorporating password and biometric characteristics. The combination of the password and unique fingerprint results in a "strong" authentication. OTP technology with token or smart card generates unique passwords value for every authentication, getting rid of susceptibility connected with permanent passwords such as guessing and hacking (Bigler, 2004). 6. References Bajikar Sundeep, 2002, “Trusted Platform Module (TPM) based Security on Notebook PCs - White Paper”, Mobile Platform Group, Intel Corporation Bigler Mark, 2004. “Single sign-on: with SSO technology, managing user access across multiple applications can be a one-step process”, Article, online, 03/12/2007, http://www.findarticles.com/p/articles/mi_m4153/is_6_61/ai_n8583698 Cisco, 2006, “Cisco − Network Security Policy: Best Practices White Paper”, Document ID: 13601, Cisco Systems Inc. Ericsson, 2006, “MANAGING NETWORK SECURITY”, White Paper, October 2006, 284 23-3075 Uen Rev A, Ericsson Systems Inc. Fujitsu Press Release, 2005, “Palm Vein Technology”, online, 03/12/07, http://www.fujitsu.com /global/about/rd/200506palm-vein.html Guel Michelle, 2001, “A Short Primer for Developing Security Policies”, The SANS Policy Primer, The SANS Institute Hino and Cannady, 2005, “ThinkPad: Integrated Fingerprint Reader-Whitepaper”, ThinkPad Security Architect, Lenovo, U.S.A. Novell, 2003, “Eliminate Security Risks: Reduce the Costs of Password Management”, Novel NSURE Business White Paper, Novell, Inc., 1800 South Novell Place, Provo, Utah 84606 USA Oppenheimer Priscilla, 2004, “Top-Down Network Design, Second Edition”, Cisco Press Publication, ISBN-10: 1-58705-152-4, Cisco Systems Inc. O'Shea and Lee, 1999, “Biometric Authentication Management”, online, 03/12/2007, http://www.technovelgy.com/ct/Technology-Article.asp?ArtNum=16 Toshiba, 2006, “Trusted Platform Module”, Tech Insight, Toshiba EasyGuard Technology, Trusted Computing Group, online, 03/13/07, www.trustedcomputinggroup.org Read More